修复系统越权访问漏洞

puzhibing

2026-08-28 f103c8c1e09e2475dc4ac4d3ddc1598146e4da38

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java

@@ -10,6 +10,8 @@
import com.ruoyi.chargingPile.api.model.Site;
import com.ruoyi.common.core.utils.StringUtils;
import com.ruoyi.common.core.web.page.PageInfo;
import com.ruoyi.common.security.service.TokenService;
import com.ruoyi.common.security.annotation.Logical;
import com.ruoyi.other.api.domain.TUserSite;
import com.ruoyi.other.api.feignClient.RoleSiteClient;
import com.ruoyi.other.api.feignClient.UserSiteClient;
@@ -19,7 +21,6 @@
import com.ruoyi.system.query.GetSysUserList;
import com.ruoyi.system.query.ShopUserStart;
import com.ruoyi.system.service.*;
import io.seata.spring.annotation.GlobalTransactional;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.apache.commons.lang3.ArrayUtils;
@@ -87,6 +88,7 @@
    /**
     * 获取用户列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/list")
    @ApiOperation(value = "获取系统用户列表", tags = {"管理后台-系统用户管理", "管理后台-角色管理"})
    public AjaxResult list(GetSysUserList getSysUserList) {
@@ -98,19 +100,24 @@
    /**
     * 获取用户选择列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR)
    @PostMapping("/getChangeUserList")
    @ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"})
    public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) {
        return AjaxResult.success(userService.getChangeUserList(query));
        PageInfo<SysUser> pageInfo = userService.getChangeUserList(query);
        if (pageInfo != null && pageInfo.getRecords() != null) {
            pageInfo.getRecords().forEach(u -> u.setPassword(null));
        }
        return AjaxResult.success(pageInfo);
    }

    /**
     * 新增用户
     */
    @RequiresPermissions(value = {"/systemUserManagement/add"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.INSERT)
    @PostMapping("/add")
    @ApiOperation(value = "添加系统用户", tags = {"管理后台-系统用户管理"})
    @GlobalTransactional(rollbackFor = Exception.class)//分布式事务
    public AjaxResult add(@RequestBody SysUser user) {
        user.setUserName(user.getPhonenumber());
        if(!org.springframework.util.StringUtils.hasLength(user.getNickName())){
@@ -125,6 +132,7 @@
        user.setCreateBy(SecurityUtils.getUsername());
        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
        user.setRoleType(1);
        user.setPassWordUpdate(new Date());
        userService.insertUser(user);
        SysUserRole sysUserRole = new SysUserRole();
        sysUserRole.setRoleId(user.getRoleId());
@@ -143,6 +151,7 @@
    }
    
    
    @RequiresPermissions(value = {"/systemUserManagement/add", "/systemUserManagement/update"}, logical = Logical.OR)
    @GetMapping("/verifyUserNameRepeat/{username}")
    @ApiOperation(value = "校验账号是否重复", tags = {"管理后台-系统用户管理"})
    public AjaxResult verifyUserNameRepeat(@PathVariable String username){
@@ -154,6 +163,9 @@
        return success();
    }
    


    @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
    @GetMapping("/getRoleSiteName/{roleId}")
    @ApiOperation(value = "获取角色对应的站点名称", tags = {"管理后台-系统用户管理"})
    public AjaxResult<List<String>> getRoleSiteName(@PathVariable Integer roleId){
@@ -172,6 +184,7 @@
    /**
     * 根据用户编号获取详细信息
     */
    @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
    @ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"})
    @GetMapping("/getInfo/{userId}")
    public AjaxResult getInfo(@PathVariable Long userId) {
@@ -187,6 +200,7 @@
            List<Site> data = siteClient.getSiteByIds(siteIds).getData();
            List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList());
            sysUser.setSiteNames(siteNames);
            sysUser.setPassword(null);
            ajax.put(AjaxResult.DATA_TAG, sysUser);
            ajax.put("postIds", postService.selectPostListByUserId(userId));
            ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList()));
@@ -198,10 +212,10 @@
    /**
     * 修改用户
     */
    @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/update")
    @ApiOperation(value = "编辑系统用户", tags = {"管理后台-系统用户管理"})
    @GlobalTransactional(rollbackFor = Exception.class)//分布式事务
    public AjaxResult edit(@Validated @RequestBody SysUser user) {
        user.setUserName(user.getPhonenumber());
        if(!org.springframework.util.StringUtils.hasLength(user.getNickName())){
@@ -239,11 +253,18 @@
        if (user.getPhonenumber() != null) {
            user.setUserName(user.getPhonenumber());
        }
        user.setPassword(null);
        user.setUpdateBy(SecurityUtils.getUsername());
        user.setUpdateTime(new Date());
        userService.updateUser(user);
    
        
        //删除旧的角色数据，添加新的角色
        userRoleService.remove(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, user.getUserId()));
        //添加新的角色数据
        SysUserRole userRole = new SysUserRole();
        userRole.setUserId(user.getUserId());
        userRole.setRoleId(user.getRoleId());
        userRoleService.save(userRole);
        
        //删除旧的站点数据后添加新的
        userSiteClient.delUserSite(user.getUserId());
        List<Integer> siteIds = user.getSiteIds();
@@ -258,15 +279,17 @@
        return success();
    }


    @Resource
    private TokenService tokenService;
    /**
     * 删除用户
     */
    @RequiresPermissions(value = {"/systemUserManagement/del"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{userIds}")
    @ApiOperation(value = "删除系统用户", tags = {"管理后台-系统用户管理"})
    public AjaxResult remove(@PathVariable Long[] userIds) {
        if (ArrayUtils.contains(userIds, SecurityUtils.getUserId())) {
        if (ArrayUtils.contains(userIds, tokenService.getLoginUser().getUserid())) {
            return error("当前用户不能删除");
        }
        return toAjax(userService.deleteUserByIds(userIds));
@@ -275,6 +298,7 @@
    


    @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR)
    @PostMapping("/shopUserStart")
    @ApiOperation(value = "账号管理--禁用/启用", tags = {"管理后台-系统用户管理"})
    public AjaxResult shopUserStart(@RequestBody ShopUserStart shopUserStart) {
@@ -293,12 +317,14 @@
    }


    @InnerAuth
    @PostMapping("/getUserList")
    public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
        List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
        return R.ok(list);
    }

    @InnerAuth
    @PostMapping("/getSysUserFromCompanyId")
    public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
        LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -346,6 +372,7 @@
        }
        return R.ok(companyUserListVos);
    }
    @InnerAuth
    @PostMapping("/isAdmin")
    public R<Integer> isAdmin(@RequestBody Long userId){
        SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -353,8 +380,9 @@
        return R.ok(id.intValue());
    }

    @InnerAuth
    @PostMapping("/getSysUser")
    public R<SysUser> getSysUser(@RequestBody Long userId) {
    public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
        try {
            SysUser sysUser = userService.selectUserById(userId);
            return R.ok(sysUser);
@@ -364,6 +392,7 @@
        }
    }

    @InnerAuth
    @PostMapping("/updateSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -371,11 +400,13 @@
            sysUser.setUpdateBy(SecurityUtils.getUsername());
            sysUser.setUpdateTime(new Date());
            userService.updateUser(sysUser);
            userRoleService.deleteSysUserRoleByUserId(sysUser.getUserId());
            SysUserRole sysUserRole = new SysUserRole();
            sysUserRole.setRoleId(sysUser.getRoleId());
            sysUserRole.setUserId(sysUser.getUserId());
            userRoleService.insertSysUserRole(sysUserRole);
            if(null != sysUser.getRoleId()){
                userRoleService.deleteSysUserRoleByUserId(sysUser.getUserId());
                SysUserRole sysUserRole = new SysUserRole();
                sysUserRole.setRoleId(sysUser.getRoleId());
                sysUserRole.setUserId(sysUser.getUserId());
                userRoleService.insertSysUserRole(sysUserRole);
            }
            return R.ok(true);
        } catch (Exception e) {
            e.printStackTrace();
@@ -384,6 +415,7 @@
    }


    @InnerAuth
    @PostMapping("/companySaveSysUser")
    public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
        List<CompanyUserListVo> list = dto.getList();
@@ -416,6 +448,7 @@
                        sysUser.setNickName(companyUserListVo.getNickName());
                        sysUser.setCreateBy(SecurityUtils.getUsername());
                        sysUser.setCreateTime(new Date());
                        sysUser.setPassWordUpdate(new Date());
                        userService.insertUser(sysUser);
                        SysUserRole sysUserRole = new SysUserRole();
                        sysUserRole.setRoleId(20l);
@@ -432,6 +465,7 @@
    }


    @InnerAuth
    @PostMapping("/addTRepairSysUser")
    public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
        List<TRepairShopAdd> list = dto.getList();
@@ -451,6 +485,7 @@
                    sysUser.setObjectId(dto.getRepairId());
                    sysUser.setUserName(add.getPhonenumber());
                    sysUser.setNickName(add.getPhonenumber());
                    sysUser.setPassWordUpdate(new Date());
                    userService.insertUser(sysUser);
                    userIds.add(sysUser.getUserId().intValue());
                }
@@ -481,7 +516,6 @@
        sysUserVo.setSysUser(sysUser);
        sysUserVo.setRoles(roles);
        sysUserVo.setPermissions(permissions);

        return R.ok(sysUserVo);
    }

@@ -507,11 +541,12 @@
     */
    @GetMapping("/getInfo")
    public AjaxResult getInfo() {
        SysUser user = userService.selectUserById(SecurityUtils.getUserId());
        SysUser user = userService.selectUserById(tokenService.getLoginUser().getUserid());
        // 角色集合
        Set<String> roles = permissionService.getRolePermission(user);
        // 权限集合
        Set<String> permissions = permissionService.getMenuPermission(user);
        user.setPassword(null);
        AjaxResult ajax = AjaxResult.success();
        ajax.put("user", user);
        ajax.put("roles", roles);
@@ -523,7 +558,7 @@
    /**
     * 重置密码
     */
    @RequiresPermissions("system:user:edit")
    @RequiresPermissions(value = {"/systemUserManagement/reset_passwords"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/resetPwd")
    @ApiOperation(value = "重置密码", tags = {"管理后台-系统用户管理"})
@@ -538,7 +573,7 @@
    /**
     * 状态修改
     */
    @RequiresPermissions("system:user:edit")
    @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult changeStatus(@RequestBody SysUser user) {
@@ -551,12 +586,14 @@
    /**
     * 根据用户编号获取授权角色
     */
    @RequiresPermissions("system:user:query")
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/authRole/{userId}")
    public AjaxResult authRole(@PathVariable("userId") Long userId) {
        userService.checkUserDataScope(userId);
        AjaxResult ajax = AjaxResult.success();
        SysUser user = userService.selectUserById(userId);
        List<SysRole> roles = roleService.selectRolesByUserId(userId);
        user.setPassword(null);
        ajax.put("user", user);
        ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
        return ajax;
@@ -565,7 +602,7 @@
    /**
     * 用户授权角色
     */
    @RequiresPermissions("system:user:edit")
    @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.GRANT)
    @PutMapping("/authRole")
    public AjaxResult insertAuthRole(Long userId, Long[] roleIds) {
@@ -577,12 +614,13 @@
    /**
     * 获取部门树列表
     */
    @RequiresPermissions("system:user:list")
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/deptTree")
    public AjaxResult deptTree(SysDept dept) {
        return success(deptService.selectDeptTreeList(dept));
    }

    @InnerAuth
    @PostMapping("/updateUser")
    public R<Boolean>  updateUser(@RequestBody SysUser sysUser){
        return R.ok(userService.updateById(sysUser));
@@ -593,6 +631,7 @@
     * @param userId
     * @return
     */
    @InnerAuth
    @PostMapping("/queryRoleByUserId/{userId}")
    public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
        SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -609,6 +648,7 @@
    }


    @InnerAuth
    @PostMapping("/queryRoleByRoleId/{roleId}")
    public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
        return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -621,6 +661,7 @@
     * @param phoneList
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhoneList")
    public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
        List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -634,6 +675,7 @@
     * @param dtoList
     * @return
     */
    @InnerAuth
    @PostMapping("/addUserRole")
    public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
        List<SysUserRole> userRoles = new ArrayList<>();
@@ -651,6 +693,7 @@
     * @param phone
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhone")
    public R<SysUser>  queryUserByPhone(@RequestBody String phone){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -666,6 +709,7 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/queryUserByUserName")
    public R<SysUser> queryUserByUserName(@RequestBody String userName){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -680,18 +724,19 @@
     * @param user
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/addSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R addSysUser(@RequestBody SysUser user){
    public R<Long> addSysUser(@RequestBody SysUser user) {
        if(StringUtils.isEmpty(user.getUserName())){
            user.setUserName(user.getPhonenumber());
        }
        if(!org.springframework.util.StringUtils.hasLength(user.getNickName())){
            user.setNickName(user.getPhonenumber());
        }
        if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {
            throw new RuntimeException("手机号已开通账号");
        }
//        if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {
//            throw new RuntimeException("手机号已开通账号");
//        }
        if (StringUtils.isNotEmpty(user.getUserName()) && !userService.checkUserNameUnique(user)) {
            throw new RuntimeException("登录账号已存在");
        }
@@ -700,16 +745,18 @@
        if(null == user.getRoleType()){
            user.setRoleType(1);
        }
        user.setPassWordUpdate(new Date());
        userService.insertUser(user);
        SysUserRole sysUserRole = new SysUserRole();
        sysUserRole.setRoleId(user.getRoleId());
        sysUserRole.setUserId(user.getUserId());
        userRoleService.insertSysUserRole(sysUserRole);
        return R.ok();
        return R.ok(user.getUserId());
    }
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/resetPassword")
    public R resetPassword(@RequestBody SysUser user) {
        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -717,4 +764,12 @@
        userService.resetPwd(user);
        return R.ok();
    }
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/getSysUserById")
    public SysUser getSysUserById(@RequestParam("userId") Long userId){
        return userService.getById(userId);
    }
}